PT-2013-3853 · Linux+2 · Linux Kernel+2

Dan Rosenberg · Published 2013-04-13 · Updated 2025-04-03 · CVE-2013-2596

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 3.8.9

Description The issue allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls. This is due to an integer overflow in the fb mmap function in drivers/video/fbmem.c. The Motochopper pwn program demonstrates this exploit.

Recommendations For Linux Kernel versions prior to 3.8.9, update to version 3.8.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the /dev/graphics/fb0 device file to minimize the risk of exploitation.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CESA-2014_1392

CVE-2013-2596

RHSA-2014:1392

RHSA-2014_1392

RHSA-2015:0695

RHSA-2015:0782

RHSA-2015:0803

RHSA-2016:0450

RHSA-2016_0450

Affected Products

Centos

Linux Kernel

Red Hat

References · 37

• 🔥 https://github.com/torvalds/linux/commit/fc9bbca8f650e5f738af8806317c0a041a48ae4a · Exploit
• 🔥 https://github.com/hiikezoe/libfb_mem_exploit · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fc9bbca8f650e5f738af8806317c0a041a48ae4a · Exploit
• 🔥 http://forum.xda-developers.com/showthread.php?t=2255491 · Exploit
• 🔥 http://droid-life.com/2013/04/09/root-method-released-for-droid-razr-hd-running-android-4-1-2-other-devices-too · Exploit
• 🔥 http://droidrzr.com/index.php/topic/15208-root-motochopper-yet-another-android-root-exploit · Exploit
• https://github.com/torvalds/linux/commit/b4cbb197c7e7a68dbad0d491242e3ca67420c13e · Patch
• https://security-tracker.debian.org/tracker/CVE-2013-2596 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2013:176 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3082.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3083.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0782.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-2596 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-2596 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html · Patch